CVE-2025-32433

CVE-2025-32433 is a missing-authentication flaw (CWE-306) in the SSH server shipped with Erlang/OTP, the runtime and libraries of the Erlang programming language. An unauthenticated attacker can send specially crafted SSH protocol messages to a vulnerable Erlang/OTP SSH daemon before authentication and trigger remote code execution. Successful exploitation yields arbitrary command execution on the host with the privileges of the SSH service, and the CVSS scope change (S:C) indicates compromise can cascade to resources beyond the vulnerable component. Affected are any systems exposing the Erlang/OTP SSH server, including standalone Erlang deployments, Debian-packaged Erlang, and Cisco products that embed Erlang/OTP (e.g., Network Services Orchestrator, ConfD Basic, Ultra Packet Core). Exploitation is confirmed in the wild: a public proof-of-concept exists, the bug was added to CISA KEV on 2025-06-09, and researchers report a surge in exploitation attempts, with roughly 70% of observed attacks targeting OT firewalls.

What to do: Upgrade Erlang/OTP to OTP-27.3.3, OTP-26.2.5.11, or OTP-25.3.2.20 depending on the release branch, and apply the corresponding updates from Cisco and Debian for embedded/packaged Erlang. Until patched, disable the Erlang SSH daemon or restrict access to it with firewall rules, prioritizing internet-exposed hosts and OT firewall devices where ~70% of observed attacks have landed. Federal agencies must apply mitigations per vendor instructions under the KEV/BOD 22-01 requirements.